Ahead of the World IPv6 day,  APNIC has launched an useful initiative to collect statistics regarding IPv6 connectivity. If you are interested in testing your clients’ IPv6 capabilities, you can use the APNIC Labs Google Analytics Tracking Code. This allows you to test your customers’ experiences connecting to your website via IPv4, IPv6, and dual-stack.

The APNIC code relies on Google Analytics. If you are using Google Analytics as a plugin in your WordPress blog, you might be interested in the versions I hacked together to integrate APNIC‘s code into the following two popular plugins:

You will need a tracking code that you can obtain at the APNIC labs web site.

Note this is not a discussion on  whether Google Analytics is Big Brotherian. Many web sites rely on it to collect statistics. I thought it might be helpful if a WordPress plugin existed that supports the APNIC feature.

The DNS resolvers used by default by Belgacom’s Internet customers lack EDNS support, according  to the test performed from OARC’s DNS Reply Size Test Server

hiram$ dig +short rs.dns-oarc.net txt @195.238.2.21
rst.x476.rs.dns-oarc.net.
rst.x485.x476.rs.dns-oarc.net.
rst.x490.x485.x476.rs.dns-oarc.net.
"195.238.24.113 DNS reply size limit is at least 490"
"195.238.24.113 lacks EDNS, defaults to 512"
"Tested at 2010-08-15 11:00:01 UTC"

hiram$ dig +short rs.dns-oarc.net txt @195.238.2.22
rst.x476.rs.dns-oarc.net.
rst.x485.x476.rs.dns-oarc.net.
rst.x490.x485.x476.rs.dns-oarc.net.
"195.238.25.113 DNS reply size limit is at least 490"
"195.238.25.113 lacks EDNS, defaults to 512"
"Tested at 2010-08-15 11:00:11 UTC

Hence, if you expect correct DNSSEC or IPv6 responses, you would be better off using alternative DNS resolvers, like OARC . Obviously, the Belgacom DNS resolvers do not return RRSIG records and do not set the AD bit. This is very disappointing, given that the DNS root is now cryptographically signed and so are several top level domains also. It is difficult to believe, a company claiming to be the number one ISP in Belgium is unable to implement a 11 year old standard defined in RFC2671, and a standard feature in all DNS resolver software since then.

The good news is that their BBOX-2 modem can proxy a EDNS query and response, when used with correctly configured DNS resolvers. As demonstrated below, the AD bit is set, meaning the DNSSEC response is valid.

; <<>> DiG 9.6.0-APPLE-P2 <<>> +dnssec +multiline -t ns gov. @XXX.XXX.XXX.XXX
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46617
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096

I have a Google Blog Search Alert looking for posts over IPv6 in my RSS reader. What strikes me is the number of posts explaining how to disable IPv6 in Windows Vista, MacOSX, Ubuntu and other flavours of Linux.

It looks like disabling IPv6 makes web browsing faster for a lot of people, independently of which operating system is being used. One guy even wrote in one of his posts “In order to fix this problem” . IPv6 was supposed to be a solution, not a problem.

I can think of several rational explanations for the poor user experience. If the DNS query for a web site first returns a AAAA record and you do not have IPv6 running smoothly, the browser will first time out before trying the IPv4 address. If the IPv6 tunnel broker, gateway, etc is overloaded, you are up for a painful experience, too.

However, it is worrying that people need to disable IPv6 on their computers. If and when there will be IPv6-only web sites, they will not be able to access them.

I sent the following to my ISP today:

You may be aware that the available pool of IPv4 addresses will be exhausted in 3 years from now. Here are some links to more information.

http://ec.europa.eu/information_society/policy/ipv6/docs/european_day/communication_final_27052008_en.pdf

http://www.ripe.net/news/community-statement.html (and similar announcements form other RIRs)

By way of this e-mail, I wish to formally ask you to make IPv6 support available to your customers.

We are often told that ISPs do not deploy IPv6 on  their network because there is no user demand, so I thought it may be useful to formally ask for it and inform you that I am willing to pay a small extra for a decent IPv6 service.

My own blog post on the subject is here:
http://www.circleid.com/posts/85288_european_commission_pushes_ipv6/

I do not expect any answer, but if it happened, I would post it here.

Update 2 june 10:21am:  The ISP has closed the ticket, without even bothering to reply. Obviously “raising awareness” is  not enough. One of these days, I will have to vote with my feet. The problem of course is that most other Belgian ISPs are even worse …

The European Commission has released a communication on IPv6, in time for the IPv6 Day in Brussels next 30th May.  It goes in the same direction as the report presented at the OECD Ministerial meeting on “Future of the Internet Economy”, that was held in Seoul, Korea earlier this next month. At the same time, the Commission committed to make its own web services available on IPv6 by 2010.

It is good to see that intergovermental organizations take the lead on this, after 10 years of failure of the private sector to actually deploy IPv6. This is a good example of why governments are needed in the Internet governance arena, be it the IGF or the GAC in ICANN.

Quick and dirty fixes like NATs allow for small investments and high short-term returns. This is what most CEOs in the Internet industry are concerned with,  because they risk to get fired if they do not provide a good and quick return to shareholders. When a long term and societal vision is needed, governments become key leading partners.

It is true that these governments also include a bunch of “supreme guides of the people’s revolution” and other sorts of autocrats and dictators. Indeed, they censor and control their local Internet. These are the same people who control other media like TV or the written press. There is nothing new under the sun, and I still do not understand some in the Internet community who like us to think the Net is different from other media and that the (bad) rules do not apply.

This is why we need the increased presence of democratic governments in Internet governance circles. Unfortunately, the current ideology in democratic countries is to let the private sector do whatever it  wants, with little political support. Not-so-democratic governments, on the contrary, tend to be very active. The end result, as we see in the IGF, is that the latter come up with requests that neither the private sector nor the “civil society” (whatever that means) can counter, because they lack the political weight. A good dictator knows the best way to silence the private sector is to become one of its customers, because no company wants to loose business.  Which leads us back to paragraph 3 above.

if (substr_count($_SERVER['REMOTE_ADDR'],":") > 0 &&substr_count($_SERVER['REMOTE_ADDR'],".") == 0) {
echo 'Congratulations ! You're using IPv6 ! Your address is'.$_SERVER['REMOTE_ADDR'].'.';
}  else {
echo "You're just using IPv4. Your address is '.$_SERVER['REMOTE_ADDR'].'.';
}

function is_connected_ipv6(){
return (substr_count($_SERVER['REMOTE_ADDR'], ":") > 0 && substr_count($_SERVER['REMOTE_ADDR'], ".") == 0);
}
echo is_connected_ipv6() ? "(via IPv6)" : "(via IPv4)";

Greylisting is a technology deployed on mail servers that has proved to be effective against spam. I use it here. However, I have yet to find a greylisting daemon for Postfix that works well with IPv6. This morning again, a message from an IPv6 SMTP host came in and the greylisting daemon did not know what to do, until I white listed the host in question.

I have tried both SQLGrey and Policyd. They work, to a degree, but are not yet as smart as they are on the IPv4 side.

Typically, it should automatically white list entire /64s for IPv6, just like it white lists /24s on IPv4. If they support either PostgreSQL or MySQL, it is even better.

Any suggestions welcome.

Now that ICANN has added IPv6 name servers for the root zone, and that many registries have enabled IPv6 on their DNS servers, I thought it would have been easy to update the DNS records pointing to my domain to mention a IPv6-only DNS server. This way, we could have native name resolution end-to-end in IPv6. We are not there yet, it seems.

The web interface my registrar (Gandi) uses does not allow IPv6 addresses. Their support desk informed me that they do not yet handle IPv6 addresses in their web forms.

There is obvious workarounds, of course. One is to assign both a IPv4 and a IPv6 address to the DNS server, as long as it is in under another domain. However, if the DNS server is under the same domain, a glue record would need to be inserted in the TLD zone file. This is currently not possible, at least with the tools provided to the average domain name user.

I am really looking forward to the IPv6 workshop that ALAC is planning at the Paris meeting of ICANN next June and see with other constituencies how these showstoppers can be addressed.

In a quasi-simultaneous announcement, both AFRINIC and RIPE NCC announced today they would start assigning provider independent IPv6 addresses to companies applying for it. The two regional registries join their North American counterpart ARIN, which started the process some months ago.

This decision will greatly help in the transition to IPv6, especially for large companies or ISPs. Until now, companies wishing to use IPv6 were barred from multihoming their Internet connection. This was particulary an issue for smaller ISPs. For any company relying on the Internet for its business, global IPv6 reachability is an important factor. However, peering agreements between Internet transit providers are often better optimized in the IPv4 world than they are in the IPv6 one. Consequently, mutihoming the connection greatly enhances their reachability.

ZDNet UK has an article on IPv6 and what may slow down its deployment. Jay Daley, from Nominet points out to the fact that the current IPv6 allocation policy used by RIPE NCC is geared towards ISPs. This is a complaint I have heard time and time again. Under the current policy, you have to show to RIPE NCC that you are going to allocate 200 address blocks to your customers before you are allocated a /32 block.

Obviously, a large corporate network cannot afford to renumber every time it switches ISPs. It does have a substantial cost. A corporation would think twice before switching ISPs. This prevents competition.
Neither can a corporation use multihoming with two or more ISPs in the current scenario, because an address block assigned to ISP A cannot be routed through ISP B. Again, this is hampering competition.

For those needing multihoming, which includes potentially every business whose operations on the Internet are critical, the current RIPE policy is clearly detrimental.

It is difficult to escape the feeling that this policy was set up by the ISPs in order to protect their business interests. Those ISPs form the vast majority of the RIPE NCC members and the majority of those attending RIPE meetings. Maybe larger end users could attend those meetings, too. However, most companies do not have the time or resources to send someone to such meetings.

A proposal by Jordi Palet Martinez, the well-known white knight of IPv6, aims at addressing this issue. It is still unclear at this stage if the proposal will go through. However the RIPE community will find it difficult to resist the pressure. ARIN, the American Regional registry is already assigning provider-independent /48 s to companies willing to “pay” for it.

I know it is quite blasphemous to talk about “paying” and “owning” IP address blocks in the RIR community. Yet, some companies have been using the same IPv4 address blocks for the last 20 years or so. They expect the same stability in the IPv6 world. They look at it as their property, in a way. I am even sure a lawyer could argue that what you have been using for 20 years, without anyone objecting, can reasonably be considered your property.

I was browsing the schedule of the upcoming ICANN meetings in San Juan and noticed a logo in the top left corner suggesting that the web site is “IPv6 enabled”.

Unfortunately, we are not there yet. Good try, maybe next time.

hiram:~ patrick$ host sanjuan2007.icann.org
sanjuan2007.icann.org is an alias for ganges.lax.icann.org.
ganges.lax.icann.org has address 208.77.191.173

hiram:~ patrick$ dig ganges.lax.icann.org AAAA
; <<>> DiG 9.3.4 <<>> ganges.lax.icann.org AAAA
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13528
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;ganges.lax.icann.org. IN AAAA

Still, congratulations to ICANN for the work they have done to make information more accessible on the web. The only missing piece now is an ICS file to be able to import the meeting schedules directly in our computer or PDA.

We keep hearing in the ICANN and IETF crowds that DNSSEC is unavoidable and that it is the way to go. These are the same crowds saying that we should move to – or at least support – IPv6. In both cases, the prophets are not always those who actually do it. While www.isoc.org and www.ietf.org are running on a dual IPv4/IPv6 stack, much of the companies working within the IETF do not run dual stack web sites: Cisco, Microsoft, IBM, Sun, etc.

So, rather than telling others that they should run DNSSEC, I figured I should do my homework and run DNSSEC myself, without waiting for my TLDs to get signed.

The job is done, but it was no easy task. If you are looking for a simple button on a GUI to sign your DNS zones, move on. Currently, this is not for the faint of heart, which might explain the slow adoption path. Bind does include all the tools, but you first have to figure out how the damn thing works and use the right parameters.

I found a tool which made my life much easier. It is called ZKT. Once you have configured the header files to your environment and adapted your file directory structure to the requisites of ZKT, you can actually sign all your zones in one pass. It will call the necessary Bind tools with the right parameters. I have created a cron job that will periodically check which signatures need updating and change the zone files accordingly. Highly recommended.

IPv6 deployment is in a chicken and egg situation. On the one hand, there is no willingness from ISPs and commodity DNS router manufacturers to include IPv6 support in their infrastructure or equipment because “there is no demand”. On the other hand, there is no demand because the average Joe Blow could not care less if he accesses a web site under IPv4 or IPv6. It should just work. The equipment and infrastructure should adapt transparently.

One of these days, when there will be IPv6-only web sites, Joe Blow will call his ISP to complain he cannot access them. This may happen sooner that you think. The North American Internet Registry (ARIN) has issued an advisory to alert the community that it will no more be in a position to allocate IPv4 addresses in the near future and strongly advises companies and ISPs to look at IPv6 instead.

What we users can do is to stop waiting for the industry to get its act together and work around its limitations.

Most consumer OSes these days support IPv6, either natively like MacOSX, Linux or Windows Vista or as an add-on, like Windows XP. If you have the traditional setup with a computer connected to the Internet through a DSL router, the latter is being assigned a dynamic IP address. Your computer in turn is being assigned an IP address by the router, typically out of a private address space (per RFC 1918).

What we need now is a way to tunnel trough the hostile IPv4 environment to connect to an IPv6 Internet. The specifications are defined in RFC 4380 and nicknamed Teredo. There is an implementation for Unix-like operating systems called Miredo. And for those of you who are uncomfortable editing Makefiles and compiling source code, the good news is that there are pre-packaged versions for MacOSX and Ubuntu Feisty (just type “apt-get install miredo”. You should have the universe repository active).

I tested both and they work out of the box. I am actually editing this post through an IPv6 tunnel over a straight IPv4 ADSL connection. Pretty amazing.

I did not test the MS Windows implementation. However, since Microsoft wrote the specs, I suppose it should be quite easy to set up there, too. Some tips are available at the IPv6 Task Force web site and Microsoft‘s own site.

What does that bring to you ? Well, first you will be considered a certified geek by your neighbourhood. More seriously, not much right now. What I notice is actually that my connection is slowing down. This may be due to the fact that tunnelling a protocol through another one is never efficient. Also, the peering agreements between backbone operators are not as optimal as they are in the IPv4 world. But at least, I am ready for the future.

I was reading this article this morning on IPv6 vulnerabilities and specifically the IPv6′s type 0 routing headers. The recommendation is to disable the routing of these headers, as they have no practical purpose anyway.

After doing some Googling, I read that this kind of header was disabled by default in Linux kernels starting with version 2.6.20.9. This server is running version 2.6.9-42. The workaround here is to filter out those packets at the firewall level. Fine, except for the fact that ip6tables on RHEL4 and CentOS4 does not include the plugin to filter out the routing headers. Hence, you need to recompile the iptables package with the ip6rt module enabled. That’s just a small Makefile editing.

To make life easier for you, here are my RPM and SRPM:

iptables-ipv6-1.2.11-3.1.isoc.i386.rpm
iptables-1.2.11-3.1.isoc.src.rpm

Once installed, do not forget to add the following lines at the top of the /etc/sysconfig/ip6tables file, near the top and before allowing anything else :

-A INPUT    -m rt --rt-type 0 -j DROP
-A FORWARD  -m rt --rt-type 0 -j DROP
-A OUTPUT   -m rt --rt-type 0 -j DROP

Of course, if you are not running IPv6 at all, this is not an issue for you. And if you are using another distribution, your mileage may vary, as they say.

The American Chamber of Commerce of Luxembourg is organizing an event tonight at the RTL TV studios called “IT, Society, and Culture”.

I will be presenting some reflections on how we went from a top-down approach of the Internet to a bottom-up proces and what the challenges are. My presentation is here in PDF format.

The main idea behind the presentation is that we have not yet reached the bottom-up phase, despite all the talk about blogs, YouTube, etc. The fact remains that the hoster of the blog or video sharing platform is still in a position to take down you web site. There is still someone, somewhere who can silence you. It is only when your platform will be under your total control that we will be able to the the user is the Internet, as Time Magazine puts it.

However, before we can reach that stage there are still some technical challenges we need to solve. If you wish to host your blog on your home computer, you need an easy to understand operating system and web server. It’s coming. You also need bandwidth. Asymetrical DSL won’t cut it. What you need is fiber to the home, with 100 Mbits both ways. You also need a fixed IP address. With current IPv4 addresses becoming scarce, IPv6 seems like the answer.

There are societal challenges, too. With IP everywhere and always on, we risk an Orwellian society where every one of your moves can be monitored. Will the average Internet user use the increased bandwidth to contribute something useful for the society, or post gore videos of men being hanged ?

This announcement by ICANN to Allocate IPv6 Blocks to the Five RIRs is an important one in several aspects.

First, it marks the real start of IPv6 deployment for the masses. Although this blog has been lucky enough to be hosted on the Restena academic network (linked to Europe’s GEANT2), and therefore was offered an IPv6 range, it is still difficult to convince many of the smaller hosters (and some big ones, too) to routinely offer IPv6 connectivity to their customers.

Your average broadband ISP is not offering IPv6 either. You cannot really blame them, since it is hard to find a DSL router supporting IPv6, unless you want to flash an unsupported firmware. In conclusion, having address space is not enough, we need the pipes and the devices that can use them.

What is also important in the ICANN announcement is that it states all RIRs have received the same amount of address space. This clearly reflects the fact that the Internet is no more US and European centric. Indeed, some regions lika Asia have a real need for more address space, due to their economic development. This is also the place where the deployment of IPv6 has been taking place for a while already.

As an aside, I got this news item thanks to Thomas Roessler’s alternative ICANN RSS feed at http://does-not-exist.org/rss/icann.rss. As mentioned by Bret Fausett, ICANN’s own RSS news feed has not been updated since June 2006.

I just got this link from Jordi Palet Martinez.

ISOC and The IPv6 Portal organize a half day IPv6 workshop in Istanbul, next Friday 28th, after the RIPE meeting.

The target audience is engineers, ICT managers, software developers and public sector. It is expected that the participants have some IPv4 knowledge in order to take bigger advantage of the workshop.

The goal of the workshop will be to introduce IPv6 from a theoretical point of view, and make some hands-on practices with Windows XP. Information about other operating systems will be also provided. The workshop will also give some basic ideas about how to enable IPv6 in ISP and enterprise networks. As a practical exercise, the participants will be able to present their own network cases and work on possible transition paths for those cases. It is expected that the participants bring their own laptops with XP SP2 to take further advantage of the hands-on part.

What is great about this initiative it that it addresses what matters most, ie how do you actually set up IPv6 in a real production environment. This is most welcome. The deployment of IPv6 has been slowed down by the fact that it still appears to be working in the lab only and not quite ready for mass deployment. From an IETF outsider’s point of view, it looks like they are still working on the specs. ‘IPv6 Test beds’ are being advertised. But again, most IT managers will consider that what is still at the test stage is not production ready.
On the software side, the lack of simple how-to documents and up to date configurations are also confusing users. As an example, there is no GUI in Windows XP to configure IPv6. You need to revert to obscure ‘netsh’ commands to make it work.
On a Linux Redhat 4 box, although you are offered to configure IPv6 at installation time, it does not define the default route. You end up with an unusable IPv6 config, unless you make the adjustments yourself.

(tip: ip -6 route add 2000::/3 via replace_this_with_your_ipv6_default_gateway).

In case you have not noticed, this blog is reachable through IPv6. Try ‘dig patrick.vande-walle.eu AAAA‘ (if you have a real operating system, of course )

According to this article on E-week, Microsoft has patented an auto configuration technology for the IP stacks in Windows machine. This was apparently inspired by the autoconfig feature of IPv6, which is described in RFC 2462 . However, Microsoft failed to mention this prior art in its patent claim.

As usual, should we say, the USPTO did a bad job at researching prior art, although the RFCs are publicly posted on the Internet. 2 minutes of googling would have produced evidence. So, if one needs an additional reason for NOT patenting sofware, we can invoke the fact that patent offices (and this includes the EPO) do a bad job at searching for prior art, even when obvious references exist on the Internet.

If Microsoft has its way to have the USPTO moving to a “first-to-file” system, as opposed to a “first-to-invent” system, no engineer if an IETF meeting will ever want to suggest anything, lest some competitor will walk out of the room to quickly file a patent. This could bring the entire IETF process to a halt. As the article describes it: “The IETF has a rule that states that such engineers sit on working groups solely on the basis of personal interest in the technology, a stance that many find naively ignores the fact that employers exert influence on their engineer employees”. Obviously yes. Whatever you do, you look at who’s signing your paycheck.